Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

Systematic workload reprovisioning: an overview

Systematic workload reprovisioning will become increasingly prevalent in leading-edge enterprises for high-risk workloads during the next five years: Gartner.

One of the toughest problems in information security is addressing advanced intrusions that have bypassed traditional security controls and now reside undetected on enterprise systems, according to Gartner, Inc. With advanced threats that are financially motivated and targeted including state-sponsored ‘advanced persistent threats,’ intrusions can remain undetected for extended periods of time.

"Once an advanced attack has gained a foothold in a system, the intrusion can remain undetected for extended periods of time, either because a signature isn't available to detect the intrusion or because it has compromised the host operating system at a deep level, so that it remains cloaked and undetectable by endpoint security controls," said Neil MacDonald, vice president and Gartner fellow. "New approaches, such as systematic workload reprovisioning, are needed to counter these advanced threats, and will require fundamental shifts in the way security professionals think about the ongoing security and management of server and desktop workloads."

The principle behind systematic workload reprovisioning (SWR) is straightforward: periodically rebuild and reprovision server and desktop workloads from a high-assurance library of base image files. Gartner analysts said that with the uptake of server and desktop virtualization techniques at the OS and application level, new scale-out resilient application architectures, and today's advanced threat environment, the time has come for enterprises to adopt a SWR strategy.

"A SWR strategy reduces the dwell time of an intruder and will appeal to information security professionals looking for new ways to counter advanced intrusions for high-risk workloads," Mr.MacDonald said.

"Systematic reprovisioning of workloads from high-assurance repositories will become an accepted strategy for high-risk workloads to counter advanced intrusions during the next five years."

Gartner predicts that by 2016, more than 20 percent of enterprises will adopt a SWR strategy for high-risk, server-based workloads, and more than 60 percent of enterprises will adopt a SWR strategy for hosted virtual desktop workloads.

Although workload reprovisioning isn't a new concept; proactive and systematic workload reprovisioning is. With SWR, the process of restoring workloads back to high-assurance states becomes the norm, not the exception, and it will become an automated, not manual, process. By periodically resetting workloads back to a high-assurance state, information security professionals proactively remove deeply rooted malware from the system, making it nearly impossible for advanced intrusions to persist, and minimizing the dwell time of undetected intrusions.

All high-risk workloads should be periodically reprovisioned, even if they appear to be healthy. Rather than live workloads being trusted, the model of trust is reduced to the high-assurance libraries and templates used to reconstruct the workloads. Workloads will be reprovisioned and restored back to a high-assurance state on a regular basis.

"Although the principle behind SWR is straightforward, the change in mindset is significant" Mr. MacDonald said. "With an SWR strategy, workloads in production are not trusted and are considered compromised. With today's advanced threat environment, we must adopt this change in thinking and adjust our security and operational strategies to reflect this."

Additional information is available in the Gartner report ‘Systematic Workload Reprovisioning as a Strategy to Counter Advanced Persistent Threats: Concepts’ at , and in the report ‘Systematic Workload Reprovisioning as a Strategy to Counter Advanced Persistent Threats: Considerations.

•Date: 16th June 2011 • Region: World •Type: Article • Topic: ICT continuity

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here